@le-space/ui 0.4.2 → 0.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@le-space/ui",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "Floating Aleph sponsor relay UI components for Svelte and React.",
   "license": "MIT",
   "type": "module",
@@ -36,8 +36,8 @@
     "access": "public"
   },
   "dependencies": {
-    "@le-space/browser": "0.4.2",
-    "@le-space/core": "0.4.2",
+    "@le-space/browser": "0.4.4",
+    "@le-space/core": "0.4.4",
     "viem": "^2.38.5"
   },
   "peerDependencies": {

package/react/index.d.ts

@@ -256,6 +256,8 @@ interface CompactBootstrapRegistrationRecord {
         registrationId?: string;
         multiaddrs: string[];
         browserMultiaddrs?: string[];
+        ownerAddress?: string;
+        publisherAddress?: string;
         updatedAt: number;
     } | null;
 }
@@ -320,6 +322,7 @@ declare class SponsorRelayController {
     private patch;
     private emitProgress;
     private configureRelayBootstrapRegistration;
+    private cleanupStaleVmBootstrapConfigHistory;
     private syncLatestDeploymentProgress;
     private canSkipRuntimeRefresh;
     private noteRuntimeRefreshResult;

package/react/index.js

@@ -28,7 +28,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.2";
+var UI_PACKAGE_VERSION = "0.4.4";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1741,14 +1741,15 @@ function describeRuntimeAvailability(runtime) {
   const mappedPorts2 = runtime.mappedPorts ?? {};
   const hostIpv4 = runtime.hostIpv4 ?? null;
   const ipv6 = runtime.ipv6 ?? null;
+  const executionGuestIpv6 = execution?.networking?.ipv6_ip ?? null;
   const proxyUrl = runtime.proxyUrl ?? null;
   const schedulerSource = runtime.allocation?.source ?? null;
   const webAccessActive = runtime.webAccess?.active ?? null;
   const mappedPortCount = Object.keys(mappedPorts2).length;
-  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && !isLikelyGlobalIpv6(ipv6)) {
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && executionGuestIpv6 && !isLikelyGlobalIpv6(executionGuestIpv6)) {
     return {
       state: "execution-invalid-public-ipv6",
-      reason: `The CRN exposed runtime networking, but the guest IPv6${ipv6 ? ` (${ipv6})` : ""} is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      reason: `The CRN exposed runtime networking, but the guest IPv6 (${executionGuestIpv6}) is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
       schedulerSource,
       executionSeen: Boolean(execution),
       webAccessActive,
@@ -2698,6 +2699,7 @@ async function publishRelayBootstrapRegistration(args) {
 var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
 var VM_BOOTSTRAP_CONFIG_SIGNAL_REF = "vm-bootstrap-config";
 var VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = "vm-bootstrap-config-status";
+var VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS = 6 * 60 * 60 * 1e3;
 function parseJsonObject(value) {
   try {
     const parsed = JSON.parse(value);
@@ -2706,6 +2708,44 @@ function parseJsonObject(value) {
     return null;
   }
 }
+function parseTimestampMs(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e12 ? value : value * 1e3;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const numeric = Number(value);
+    if (Number.isFinite(numeric)) {
+      return numeric > 1e12 ? numeric : numeric * 1e3;
+    }
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+}
+function normalizeVmBootstrapConfigRecord(deploymentTokenKey, value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const createdAt = typeof candidate.createdAt === "string" ? candidate.createdAt.trim() : "";
+  const expiresAt = typeof candidate.expiresAt === "string" ? candidate.expiresAt.trim() : "";
+  if (!deploymentTokenKey.trim() || !deploymentToken || deploymentToken !== deploymentTokenKey.trim() || !profile || !ownerAddress || !instanceItemHash || !createdAt || !expiresAt) {
+    return null;
+  }
+  const nowMs = Math.max(0, Number(options.nowMs ?? Date.now()));
+  const maxRecordAgeMs = Math.max(
+    6e4,
+    Number(options.maxRecordAgeMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const createdAtMs = parseTimestampMs(createdAt);
+  const expiresAtMs = parseTimestampMs(expiresAt);
+  if (createdAtMs == null || expiresAtMs == null) return null;
+  if (expiresAtMs <= nowMs) return null;
+  if (createdAtMs < nowMs - maxRecordAgeMs) return null;
+  return candidate;
+}
 async function fetchVmBootstrapConfigAggregate(address, options) {
   const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
   requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
@@ -2719,16 +2759,21 @@ async function fetchVmBootstrapConfigAggregate(address, options) {
   if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
   return aggregate;
 }
-function normalizeVmBootstrapConfigAggregate(aggregate) {
+function normalizeVmBootstrapConfigAggregate(aggregate, options = {}) {
   if (!aggregate || typeof aggregate !== "object") return {};
   return Object.fromEntries(
-    Object.entries(aggregate).filter(
-      (entry) => Boolean(entry[1] && typeof entry[1] === "object" && !Array.isArray(entry[1]))
-    )
+    Object.entries(aggregate).map(([deploymentToken, record]) => [
+      deploymentToken,
+      normalizeVmBootstrapConfigRecord(deploymentToken, record, options)
+    ]).filter((entry) => entry[1] != null)
   );
 }
 function createVmBootstrapConfigAggregateContent(args) {
-  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate);
+  const nowMs = Math.max(0, Number(args.now ?? Date.now() / 1e3) * 1e3);
+  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate, {
+    nowMs,
+    maxRecordAgeMs: args.maxRecordAgeMs
+  });
   content[args.record.deploymentToken] = args.record;
   return {
     address: args.sender,
@@ -2773,6 +2818,55 @@ async function publishVmBootstrapConfigAggregate(args) {
     aggregateStatus
   };
 }
+function normalizeAggregateMessageHashRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const itemHash = typeof candidate.item_hash === "string" ? candidate.item_hash.trim() : "";
+  if (!itemHash) return null;
+  const content = candidate.content && typeof candidate.content === "object" && !Array.isArray(candidate.content) ? candidate.content : typeof candidate.item_content === "string" ? parseJsonObject(candidate.item_content) : null;
+  if (!content || content.key !== VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY) return null;
+  const timeMs = parseTimestampMs(candidate.time);
+  if (timeMs == null) return null;
+  return { itemHash, timeMs };
+}
+async function listStaleVmBootstrapConfigAggregateMessageHashes(args) {
+  const address = args.address.trim();
+  if (!address) return [];
+  const currentAggregateItemHash = args.currentAggregateItemHash?.trim() ?? "";
+  const olderThanMs = Math.max(
+    6e4,
+    Number(args.olderThanMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const cutoffMs = Math.max(0, Number(args.nowMs ?? Date.now()) - olderThanMs);
+  const pagination = Math.max(1, Number(args.pagination ?? 100));
+  const maxPages = Math.max(1, Number(args.maxPages ?? 10));
+  const hashes = /* @__PURE__ */ new Set();
+  for (let page = 1; page <= maxPages; page += 1) {
+    const requestUrl = new URL("/api/v0/messages.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+    requestUrl.searchParams.set("msgType", "AGGREGATE");
+    requestUrl.searchParams.set("addresses", address);
+    requestUrl.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+    requestUrl.searchParams.set("pagination", String(pagination));
+    requestUrl.searchParams.set("page", String(page));
+    requestUrl.searchParams.set("sortOrder", "-1");
+    const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+    if (!response.ok) {
+      throw new Error(`VM bootstrap config aggregate history request failed: ${response.status}`);
+    }
+    const payload = await response.json();
+    const messages = Array.isArray(payload.messages) ? payload.messages : [];
+    if (messages.length === 0) break;
+    for (const message of messages) {
+      const normalized = normalizeAggregateMessageHashRecord(message);
+      if (!normalized) continue;
+      if (normalized.itemHash === currentAggregateItemHash) continue;
+      if (normalized.timeMs > cutoffMs) continue;
+      hashes.add(normalized.itemHash);
+    }
+    if (messages.length < pagination) break;
+  }
+  return [...hashes];
+}
 async function publishVmBootstrapConfig(args) {
   const aggregate = await fetchVmBootstrapConfigAggregate(args.sender, {
     apiHost: args.apiHost,
@@ -2781,7 +2875,8 @@ async function publishVmBootstrapConfig(args) {
   const content = createVmBootstrapConfigAggregateContent({
     sender: args.sender,
     record: args.record,
-    existingAggregate: aggregate
+    existingAggregate: aggregate,
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
   });
   const result = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -2803,7 +2898,9 @@ async function deleteVmBootstrapConfig(args) {
     apiHost: args.apiHost,
     fetch: args.fetch
   });
-  const content = normalizeVmBootstrapConfigAggregate(aggregate);
+  const content = normalizeVmBootstrapConfigAggregate(aggregate, {
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
+  });
   delete content[args.deploymentToken];
   const publishResult = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -3104,7 +3201,7 @@ function rootfsHealth(args) {
     return {
       tone: "error",
       label: "not found on Aleph",
-      detail: "The referenced rootfs STORE message is not available yet."
+      detail: "The manifest points to a rootfs STORE message that Aleph cannot find. Check that the manifest URL is correct and that the referenced rootfs was not forgotten."
     };
   }
   if (!args.resolution) {
@@ -3137,8 +3234,8 @@ function rootfsHealth(args) {
   }
   return {
     tone: "error",
-    label: "not deployable",
-    detail: args.resolution.rejectionReason ?? "Aleph rejected the rootfs reference."
+    label: "manifest rootfs not deployable",
+    detail: args.resolution.rejectionReason ?? (args.resolution.messageType === "STORE" ? "This manifest points to a rootfs STORE message that exists but is not deployable anymore, for example because it was forgotten or replaced. Double-check the manifest URL." : "Aleph rejected the rootfs reference. Double-check that the manifest URL points to the intended current rootfs.")
   };
 }
 async function resolveManifest(args) {
@@ -3167,6 +3264,22 @@ function relayBootstrapInstanceItemHash(entry) {
   }
   return registrationIdInstanceItemHash(entry?.content?.registrationId);
 }
+function relayBootstrapMatchesCurrentWallet(entry, normalizedWalletAddress, activeInstanceHashes) {
+  const instanceItemHash = relayBootstrapInstanceItemHash(entry);
+  if (instanceItemHash && activeInstanceHashes.has(instanceItemHash)) {
+    return true;
+  }
+  const candidateAddresses = [
+    entry?.address,
+    entry?.content?.ownerAddress,
+    entry?.content?.authorization?.payload?.ownerAddress,
+    entry?.content?.publisherAddress,
+    entry?.content?.authorization?.payload?.publisherAddress
+  ];
+  return candidateAddresses.some(
+    (value) => typeof value === "string" && value.trim().toLowerCase() === normalizedWalletAddress
+  );
+}
 async function inspectInstanceRuntime(args) {
   const details = {
     messageStatus: String(
@@ -3682,6 +3795,16 @@ var SponsorRelayController = class {
       });
     }
     if (!relayMetadata) {
+      await this.refresh().catch(() => void 0);
+      const confirmedAfterRefresh = this.state.bootstrapRegistrations.some(
+        (entry) => entry.instanceItemHash === args.itemHash && entry.confirmed
+      );
+      if (confirmedAfterRefresh) {
+        this.trace("deploy:relay-metadata-recovered-from-refresh", {
+          itemHash: args.itemHash
+        });
+        return;
+      }
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
     const { peerId } = relayMetadata;
@@ -3790,6 +3913,7 @@ var SponsorRelayController = class {
       }
     }
     if (profile === "uc-go-peer" && args.deploymentToken) {
+      let cleanupAggregateItemHash = null;
       await deleteVmBootstrapConfig({
         sender: this.state.wallet.address,
         deploymentToken: args.deploymentToken,
@@ -3798,6 +3922,14 @@ var SponsorRelayController = class {
         fetch: asJsonFetch,
         apiHost: this.client.apiHost,
         sync: true
+      }).then((cleanupResult) => {
+        cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
+        this.trace("deploy:bootstrap-config-cleanup-complete", {
+          itemHash: args.itemHash,
+          deploymentToken: args.deploymentToken,
+          aggregateItemHash: cleanupResult.aggregateItemHash,
+          aggregateStatus: cleanupResult.aggregateStatus
+        });
       }).catch((error) => {
         this.trace("deploy:bootstrap-config-cleanup-error", {
           itemHash: args.itemHash,
@@ -3805,8 +3937,75 @@ var SponsorRelayController = class {
           error: error instanceof Error ? error.message : String(error)
         });
       });
+      await this.cleanupStaleVmBootstrapConfigHistory({
+        itemHash: args.itemHash,
+        currentAggregateItemHash: cleanupAggregateItemHash,
+        stage: "publishing-bootstrap",
+        progress: 99
+      });
     }
   }
+  async cleanupStaleVmBootstrapConfigHistory(args) {
+    if (!this.state.wallet.address || !args.currentAggregateItemHash) {
+      return;
+    }
+    const staleHashes = await listStaleVmBootstrapConfigAggregateMessageHashes({
+      address: this.state.wallet.address,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      olderThanMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-scan-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return [];
+    });
+    if (staleHashes.length === 0) {
+      return;
+    }
+    const staleCount = staleHashes.length;
+    this.emitProgress({
+      stage: args.stage,
+      label: "Cleaning up stale handoff history",
+      progress: args.progress,
+      status: "warning",
+      itemHash: args.itemHash,
+      detail: `Forgetting ${staleCount} superseded Aleph handoff aggregate message${staleCount === 1 ? "" : "s"} older than 6 hours. MetaMask may request another cleanup signature.`
+    });
+    this.trace("deploy:bootstrap-config-history-cleanup-start", {
+      itemHash: args.itemHash,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      staleHashes
+    });
+    await forgetAlephMessages({
+      sender: this.state.wallet.address,
+      hashes: staleHashes,
+      reason: "Prune stale vm-bootstrap-config aggregate history older than 6 hours",
+      signer: personalSign,
+      hasher: sha256Hex,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost,
+      sync: true
+    }).then((cleanupResult) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-complete", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        forgetItemHash: cleanupResult.itemHash,
+        forgetStatus: cleanupResult.status
+      });
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  }
   syncLatestDeploymentProgress(instances) {
     const itemHash = this.state.lastDeploymentHash;
     if (!itemHash) {
@@ -3882,6 +4081,20 @@ var SponsorRelayController = class {
       });
       return;
     }
+    const hasConfirmedBootstrapRegistration = this.state.bootstrapRegistrations.some(
+      (entry) => entry.instanceItemHash === itemHash && entry.confirmed
+    );
+    if (hasConfirmedBootstrapRegistration) {
+      this.emitProgress({
+        stage: "completed",
+        label: "Relay ready",
+        progress: 100,
+        status: "success",
+        itemHash,
+        detail: "Runtime networking is available and the relay bootstrap registration is confirmed on Aleph."
+      });
+      return;
+    }
     this.emitProgress({
       stage: "deployment-confirmed",
       label: "Runtime ready",
@@ -4182,7 +4395,11 @@ var SponsorRelayController = class {
           instances.map((entry) => entry.instance.item_hash)
         );
         bootstrapRegistrations = selectCurrentRelayBootstrapPosts(rawBootstrapPosts).filter(
-          (entry) => entry.address?.toLowerCase() === normalizedWalletAddress
+          (entry) => relayBootstrapMatchesCurrentWallet(
+            entry,
+            normalizedWalletAddress,
+            activeInstanceHashes
+          )
         ).map((entry) => {
           const instanceItemHash = relayBootstrapInstanceItemHash(entry);
           const messageHash = entry.itemHash ?? entry.hash ?? null;
@@ -4201,6 +4418,8 @@ var SponsorRelayController = class {
               registrationId: entry.content.registrationId,
               multiaddrs: Array.isArray(entry.content.multiaddrs) ? entry.content.multiaddrs : [],
               browserMultiaddrs: Array.isArray(entry.content.browserMultiaddrs) ? entry.content.browserMultiaddrs : [],
+              ownerAddress: typeof entry.content.ownerAddress === "string" ? entry.content.ownerAddress : void 0,
+              publisherAddress: typeof entry.content.publisherAddress === "string" ? entry.content.publisherAddress : void 0,
               updatedAt: entry.content.updatedAt
             } : null
           };
@@ -4272,9 +4491,9 @@ var SponsorRelayController = class {
       this.patch({ errorText: "Connect MetaMask before deploying." });
       return;
     }
-    if (!this.state.manifest || !this.state.rootfsVerified || !this.state.pricingSummary.pricing || !this.state.pricingSummary.tier) {
+    if (!this.state.manifest || this.state.rootfsHealth.tone !== "ok" || !this.state.pricingSummary.pricing || !this.state.pricingSummary.tier) {
       this.patch({
-        errorText: "Manifest, rootfs, and pricing must be ready before deploying."
+        errorText: this.state.rootfsHealth.tone === "error" ? `Cannot deploy: ${this.state.rootfsHealth.detail ?? this.state.rootfsHealth.label}` : "Manifest, rootfs, and pricing must be ready before deploying."
       });
       return;
     }
@@ -4316,6 +4535,7 @@ var SponsorRelayController = class {
       for (const [candidateIndex, candidateCrn] of orderedCrns.entries()) {
         let attemptItemHash = null;
         let attemptDeploymentToken = null;
+        let attemptProfile = null;
         const crnAttemptLabel = `CRN ${candidateIndex + 1}/${orderedCrns.length}`;
         const crnDisplayName = candidateCrn.name ?? candidateCrn.hash;
         this.emitProgress({
@@ -4327,6 +4547,7 @@ var SponsorRelayController = class {
         });
         try {
           const profile = relayProfileForManifest(this.state.manifest);
+          attemptProfile = profile;
           const sshPublicKey = profile === "uc-go-peer" ? appendDeploymentTokenToSshPublicKey(
             this.state.sshPublicKey.trim(),
             this.state.wallet.address,
@@ -4562,6 +4783,106 @@ var SponsorRelayController = class {
             itemHash: attemptItemHash,
             error: lastError.message
           });
+          if (attemptItemHash && attemptDeploymentToken && attemptProfile && !failedDueToInvalidIpv6) {
+            try {
+              const latestRuntime = await fetchVmRuntime({
+                itemHash: attemptItemHash,
+                fetch: (url, init) => fetch(url, init),
+                crnHash: candidateCrn.hash,
+                crns: this.state.crns,
+                crnListUrl: this.props.crnListUrl,
+                requirePublicGuestIpv6ForProxy: true
+              });
+              if (latestRuntime.diagnostics?.state === "ready") {
+                const reconciledRelayMetadata = await fetchRelayMetadataForRuntime({
+                  runtime: latestRuntime,
+                  fetch: (url, init) => fetch(url, init),
+                  preferSecureMetadata: attemptProfile === "uc-go-peer" && Boolean(latestRuntime.proxyUrl),
+                  attempts: 3,
+                  delayMs: 1e3,
+                  timeoutMs: 15e3
+                }).catch(() => null);
+                if (reconciledRelayMetadata) {
+                  const registrationId = createRelayBootstrapRegistrationId(
+                    attemptProfile,
+                    this.state.instanceName.trim(),
+                    attemptItemHash
+                  );
+                  const visibleRegistration = await waitForRelayBootstrapRegistration({
+                    registrationId,
+                    peerId: reconciledRelayMetadata.peerId,
+                    fetch: asJsonFetch,
+                    apiHost: this.client.apiHost,
+                    attempts: 3,
+                    delayMs: 1e3
+                  }).catch(() => null);
+                  if (visibleRegistration) {
+                    this.trace("deploy:recovered-after-error", {
+                      itemHash: attemptItemHash,
+                      registrationId,
+                      peerId: reconciledRelayMetadata.peerId,
+                      error: lastError.message
+                    });
+                    this.rememberRuntimeDetails(attemptItemHash, {
+                      messageStatus: "processed",
+                      allocationSource: latestRuntime.allocation?.source ?? null,
+                      crnUrl: latestRuntime.allocation?.crnUrl ?? latestRuntime.execution?.crnUrl ?? null,
+                      hostIpv4: latestRuntime.hostIpv4 ?? null,
+                      ipv6: latestRuntime.ipv6 ?? null,
+                      vmIpv4: latestRuntime.execution?.networking?.ipv4_ip ?? null,
+                      webUrl: latestRuntime.webAccessUrl ?? latestRuntime.proxyUrl ?? latestRuntime.execution?.networking?.proxy_url ?? null,
+                      sshCommand: latestRuntime.sshCommand ?? null,
+                      mappedPorts: latestRuntime.execution != null ? mappedPorts(latestRuntime.execution) : runtimeMappedPorts(latestRuntime.mappedPorts),
+                      execution: latestRuntime.execution ?? null,
+                      error: null
+                    });
+                    this.patch({
+                      busy: { deploying: false }
+                    });
+                    await this.refresh();
+                    this.lastCompletedDeploymentHash = attemptItemHash;
+                    this.emitProgress({
+                      stage: "completed",
+                      label: "Relay ready",
+                      progress: 100,
+                      status: "success",
+                      itemHash: attemptItemHash,
+                      detail: "The relay completed startup after a transient UI polling error. Runtime and bootstrap registration are confirmed."
+                    });
+                    return;
+                  }
+                }
+              }
+            } catch (reconcileError) {
+              this.trace("deploy:recovery-check-error", {
+                itemHash: attemptItemHash,
+                error: reconcileError instanceof Error ? reconcileError.message : String(reconcileError)
+              });
+            }
+            await this.refresh().catch(() => void 0);
+            const recoveredRegistration = this.state.bootstrapRegistrations.some(
+              (entry) => entry.instanceItemHash === attemptItemHash && entry.confirmed
+            );
+            if (recoveredRegistration) {
+              this.trace("deploy:recovered-from-refresh-state", {
+                itemHash: attemptItemHash,
+                error: lastError.message
+              });
+              this.patch({
+                busy: { deploying: false }
+              });
+              this.lastCompletedDeploymentHash = attemptItemHash;
+              this.emitProgress({
+                stage: "completed",
+                label: "Relay ready",
+                progress: 100,
+                status: "success",
+                itemHash: attemptItemHash,
+                detail: "The relay completed startup after a transient browser-side polling error. Runtime and bootstrap registration are confirmed."
+              });
+              return;
+            }
+          }
           if (attemptItemHash) {
             this.emitProgress({
               stage: "deployment-confirmed",
@@ -4572,6 +4893,7 @@ var SponsorRelayController = class {
               detail: failedDueToInvalidIpv6 ? `${attemptLabel} exposed runtime networking that cannot support proxy-backed HTTPS. Cleaning up this attempt before retrying another CRN.` : `${attemptLabel} failed: ${lastError.message} Cleaning up this attempt before retrying another CRN.`
             });
             if (attemptDeploymentToken) {
+              let cleanupAggregateItemHash = null;
               this.emitProgress({
                 stage: "deployment-confirmed",
                 label: "Cleaning up failed attempt",
@@ -4593,6 +4915,7 @@ var SponsorRelayController = class {
                 apiHost: this.client.apiHost,
                 sync: true
               }).then((cleanupResult) => {
+                cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
                 this.trace("deploy:bootstrap-config-cleanup-complete", {
                   itemHash: attemptItemHash,
                   deploymentToken: attemptDeploymentToken,
@@ -4606,6 +4929,12 @@ var SponsorRelayController = class {
                   error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
                 });
               });
+              await this.cleanupStaleVmBootstrapConfigHistory({
+                itemHash: attemptItemHash,
+                currentAggregateItemHash: cleanupAggregateItemHash,
+                stage: "deployment-confirmed",
+                progress: 18
+              });
             }
             this.emitProgress({
               stage: "deployment-confirmed",
@@ -5709,6 +6038,7 @@ function SponsorRelayFab(props) {
           {
             type: "button",
             onClick: () => void (state.wallet.connected ? controller.deploy() : controller.connectWallet()),
+            disabled: state.wallet.connected ? state.busy.deploying || state.rootfsHealth.tone !== "ok" : state.busy.connectingWallet,
             style: { ...primaryButtonStyle, width: "100%", marginTop: "1rem" },
             children: state.wallet.connected ? state.busy.deploying ? "Deploying\u2026" : "Deploy Relay" : "Connect MetaMask"
           }

package/shared/index.d.ts

@@ -254,6 +254,8 @@ interface CompactBootstrapRegistrationRecord {
         registrationId?: string;
         multiaddrs: string[];
         browserMultiaddrs?: string[];
+        ownerAddress?: string;
+        publisherAddress?: string;
         updatedAt: number;
     } | null;
 }
@@ -309,7 +311,7 @@ declare const STALE_INSTANCE_ALLOCATION_COOLDOWN_MS: number;
 declare const RECENT_INSTANCE_RUNTIME_GRACE_MS: number;
 declare const DEPLOYMENT_PENDING_WARNING_MS: number;
 
-declare const UI_PACKAGE_VERSION = "0.4.2";
+declare const UI_PACKAGE_VERSION = "0.4.4";
 
 interface RootfsRequiredPortForward {
     port: number;
@@ -368,6 +370,7 @@ declare class SponsorRelayController {
     private patch;
     private emitProgress;
     private configureRelayBootstrapRegistration;
+    private cleanupStaleVmBootstrapConfigHistory;
     private syncLatestDeploymentProgress;
     private canSkipRuntimeRefresh;
     private noteRuntimeRefreshResult;

package/shared/index.js

@@ -27,7 +27,7 @@ var RECENT_INSTANCE_RUNTIME_GRACE_MS = 10 * 60 * 1e3;
 var DEPLOYMENT_PENDING_WARNING_MS = 3 * 60 * 1e3;
 
 // src/shared/package-version.ts
-var UI_PACKAGE_VERSION = "0.4.2";
+var UI_PACKAGE_VERSION = "0.4.4";
 
 // src/shared/format.ts
 function shortHash(value, head = 8, tail = 6) {
@@ -1740,14 +1740,15 @@ function describeRuntimeAvailability(runtime) {
   const mappedPorts2 = runtime.mappedPorts ?? {};
   const hostIpv4 = runtime.hostIpv4 ?? null;
   const ipv6 = runtime.ipv6 ?? null;
+  const executionGuestIpv6 = execution?.networking?.ipv6_ip ?? null;
   const proxyUrl = runtime.proxyUrl ?? null;
   const schedulerSource = runtime.allocation?.source ?? null;
   const webAccessActive = runtime.webAccess?.active ?? null;
   const mappedPortCount = Object.keys(mappedPorts2).length;
-  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && !isLikelyGlobalIpv6(ipv6)) {
+  if (hostIpv4 && mappedPortCount > 0 && runtime.requirePublicGuestIpv6ForProxy === true && proxyUrl && executionGuestIpv6 && !isLikelyGlobalIpv6(executionGuestIpv6)) {
     return {
       state: "execution-invalid-public-ipv6",
-      reason: `The CRN exposed runtime networking, but the guest IPv6${ipv6 ? ` (${ipv6})` : ""} is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
+      reason: `The CRN exposed runtime networking, but the guest IPv6 (${executionGuestIpv6}) is not globally routable. Proxy-backed HTTPS activation cannot succeed until the CRN reports a public guest IPv6.`,
       schedulerSource,
       executionSeen: Boolean(execution),
       webAccessActive,
@@ -2697,6 +2698,7 @@ async function publishRelayBootstrapRegistration(args) {
 var VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY = "vm-bootstrap-config";
 var VM_BOOTSTRAP_CONFIG_SIGNAL_REF = "vm-bootstrap-config";
 var VM_BOOTSTRAP_CONFIG_SIGNAL_POST_TYPE = "vm-bootstrap-config-status";
+var VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS = 6 * 60 * 60 * 1e3;
 function parseJsonObject(value) {
   try {
     const parsed = JSON.parse(value);
@@ -2705,6 +2707,44 @@ function parseJsonObject(value) {
     return null;
   }
 }
+function parseTimestampMs(value) {
+  if (typeof value === "number" && Number.isFinite(value)) {
+    return value > 1e12 ? value : value * 1e3;
+  }
+  if (typeof value === "string" && value.trim()) {
+    const numeric = Number(value);
+    if (Number.isFinite(numeric)) {
+      return numeric > 1e12 ? numeric : numeric * 1e3;
+    }
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) ? parsed : null;
+  }
+  return null;
+}
+function normalizeVmBootstrapConfigRecord(deploymentTokenKey, value, options = {}) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const deploymentToken = typeof candidate.deploymentToken === "string" ? candidate.deploymentToken.trim() : "";
+  const profile = typeof candidate.profile === "string" ? candidate.profile.trim() : "";
+  const ownerAddress = typeof candidate.ownerAddress === "string" ? candidate.ownerAddress.trim() : "";
+  const instanceItemHash = typeof candidate.instanceItemHash === "string" ? candidate.instanceItemHash.trim() : "";
+  const createdAt = typeof candidate.createdAt === "string" ? candidate.createdAt.trim() : "";
+  const expiresAt = typeof candidate.expiresAt === "string" ? candidate.expiresAt.trim() : "";
+  if (!deploymentTokenKey.trim() || !deploymentToken || deploymentToken !== deploymentTokenKey.trim() || !profile || !ownerAddress || !instanceItemHash || !createdAt || !expiresAt) {
+    return null;
+  }
+  const nowMs = Math.max(0, Number(options.nowMs ?? Date.now()));
+  const maxRecordAgeMs = Math.max(
+    6e4,
+    Number(options.maxRecordAgeMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const createdAtMs = parseTimestampMs(createdAt);
+  const expiresAtMs = parseTimestampMs(expiresAt);
+  if (createdAtMs == null || expiresAtMs == null) return null;
+  if (expiresAtMs <= nowMs) return null;
+  if (createdAtMs < nowMs - maxRecordAgeMs) return null;
+  return candidate;
+}
 async function fetchVmBootstrapConfigAggregate(address, options) {
   const requestUrl = new URL(`/api/v0/aggregates/${address}.json`, options.apiHost ?? DEFAULT_ALEPH_API_HOST2);
   requestUrl.searchParams.set("keys", VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY);
@@ -2718,16 +2758,21 @@ async function fetchVmBootstrapConfigAggregate(address, options) {
   if (!aggregate || typeof aggregate !== "object" || Array.isArray(aggregate)) return {};
   return aggregate;
 }
-function normalizeVmBootstrapConfigAggregate(aggregate) {
+function normalizeVmBootstrapConfigAggregate(aggregate, options = {}) {
   if (!aggregate || typeof aggregate !== "object") return {};
   return Object.fromEntries(
-    Object.entries(aggregate).filter(
-      (entry) => Boolean(entry[1] && typeof entry[1] === "object" && !Array.isArray(entry[1]))
-    )
+    Object.entries(aggregate).map(([deploymentToken, record]) => [
+      deploymentToken,
+      normalizeVmBootstrapConfigRecord(deploymentToken, record, options)
+    ]).filter((entry) => entry[1] != null)
   );
 }
 function createVmBootstrapConfigAggregateContent(args) {
-  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate);
+  const nowMs = Math.max(0, Number(args.now ?? Date.now() / 1e3) * 1e3);
+  const content = normalizeVmBootstrapConfigAggregate(args.existingAggregate, {
+    nowMs,
+    maxRecordAgeMs: args.maxRecordAgeMs
+  });
   content[args.record.deploymentToken] = args.record;
   return {
     address: args.sender,
@@ -2772,6 +2817,55 @@ async function publishVmBootstrapConfigAggregate(args) {
     aggregateStatus
   };
 }
+function normalizeAggregateMessageHashRecord(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const candidate = value;
+  const itemHash = typeof candidate.item_hash === "string" ? candidate.item_hash.trim() : "";
+  if (!itemHash) return null;
+  const content = candidate.content && typeof candidate.content === "object" && !Array.isArray(candidate.content) ? candidate.content : typeof candidate.item_content === "string" ? parseJsonObject(candidate.item_content) : null;
+  if (!content || content.key !== VM_BOOTSTRAP_CONFIG_AGGREGATE_KEY) return null;
+  const timeMs = parseTimestampMs(candidate.time);
+  if (timeMs == null) return null;
+  return { itemHash, timeMs };
+}
+async function listStaleVmBootstrapConfigAggregateMessageHashes(args) {
+  const address = args.address.trim();
+  if (!address) return [];
+  const currentAggregateItemHash = args.currentAggregateItemHash?.trim() ?? "";
+  const olderThanMs = Math.max(
+    6e4,
+    Number(args.olderThanMs ?? VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS)
+  );
+  const cutoffMs = Math.max(0, Number(args.nowMs ?? Date.now()) - olderThanMs);
+  const pagination = Math.max(1, Number(args.pagination ?? 100));
+  const maxPages = Math.max(1, Number(args.maxPages ?? 10));
+  const hashes = /* @__PURE__ */ new Set();
+  for (let page = 1; page <= maxPages; page += 1) {
+    const requestUrl = new URL("/api/v0/messages.json", args.apiHost ?? DEFAULT_ALEPH_API_HOST2);
+    requestUrl.searchParams.set("msgType", "AGGREGATE");
+    requestUrl.searchParams.set("addresses", address);
+    requestUrl.searchParams.set("message_statuses", "processed,pending,rejected,removing");
+    requestUrl.searchParams.set("pagination", String(pagination));
+    requestUrl.searchParams.set("page", String(page));
+    requestUrl.searchParams.set("sortOrder", "-1");
+    const response = await args.fetch(requestUrl.toString(), { cache: "no-cache" });
+    if (!response.ok) {
+      throw new Error(`VM bootstrap config aggregate history request failed: ${response.status}`);
+    }
+    const payload = await response.json();
+    const messages = Array.isArray(payload.messages) ? payload.messages : [];
+    if (messages.length === 0) break;
+    for (const message of messages) {
+      const normalized = normalizeAggregateMessageHashRecord(message);
+      if (!normalized) continue;
+      if (normalized.itemHash === currentAggregateItemHash) continue;
+      if (normalized.timeMs > cutoffMs) continue;
+      hashes.add(normalized.itemHash);
+    }
+    if (messages.length < pagination) break;
+  }
+  return [...hashes];
+}
 async function publishVmBootstrapConfig(args) {
   const aggregate = await fetchVmBootstrapConfigAggregate(args.sender, {
     apiHost: args.apiHost,
@@ -2780,7 +2874,8 @@ async function publishVmBootstrapConfig(args) {
   const content = createVmBootstrapConfigAggregateContent({
     sender: args.sender,
     record: args.record,
-    existingAggregate: aggregate
+    existingAggregate: aggregate,
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
   });
   const result = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -2802,7 +2897,9 @@ async function deleteVmBootstrapConfig(args) {
     apiHost: args.apiHost,
     fetch: args.fetch
   });
-  const content = normalizeVmBootstrapConfigAggregate(aggregate);
+  const content = normalizeVmBootstrapConfigAggregate(aggregate, {
+    maxRecordAgeMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS
+  });
   delete content[args.deploymentToken];
   const publishResult = await publishVmBootstrapConfigAggregate({
     sender: args.sender,
@@ -3103,7 +3200,7 @@ function rootfsHealth(args) {
     return {
       tone: "error",
       label: "not found on Aleph",
-      detail: "The referenced rootfs STORE message is not available yet."
+      detail: "The manifest points to a rootfs STORE message that Aleph cannot find. Check that the manifest URL is correct and that the referenced rootfs was not forgotten."
     };
   }
   if (!args.resolution) {
@@ -3136,8 +3233,8 @@ function rootfsHealth(args) {
   }
   return {
     tone: "error",
-    label: "not deployable",
-    detail: args.resolution.rejectionReason ?? "Aleph rejected the rootfs reference."
+    label: "manifest rootfs not deployable",
+    detail: args.resolution.rejectionReason ?? (args.resolution.messageType === "STORE" ? "This manifest points to a rootfs STORE message that exists but is not deployable anymore, for example because it was forgotten or replaced. Double-check the manifest URL." : "Aleph rejected the rootfs reference. Double-check that the manifest URL points to the intended current rootfs.")
   };
 }
 async function resolveManifest(args) {
@@ -3166,6 +3263,22 @@ function relayBootstrapInstanceItemHash(entry) {
   }
   return registrationIdInstanceItemHash(entry?.content?.registrationId);
 }
+function relayBootstrapMatchesCurrentWallet(entry, normalizedWalletAddress, activeInstanceHashes) {
+  const instanceItemHash = relayBootstrapInstanceItemHash(entry);
+  if (instanceItemHash && activeInstanceHashes.has(instanceItemHash)) {
+    return true;
+  }
+  const candidateAddresses = [
+    entry?.address,
+    entry?.content?.ownerAddress,
+    entry?.content?.authorization?.payload?.ownerAddress,
+    entry?.content?.publisherAddress,
+    entry?.content?.authorization?.payload?.publisherAddress
+  ];
+  return candidateAddresses.some(
+    (value) => typeof value === "string" && value.trim().toLowerCase() === normalizedWalletAddress
+  );
+}
 async function inspectInstanceRuntime(args) {
   const details = {
     messageStatus: String(
@@ -3681,6 +3794,16 @@ var SponsorRelayController = class {
       });
     }
     if (!relayMetadata) {
+      await this.refresh().catch(() => void 0);
+      const confirmedAfterRefresh = this.state.bootstrapRegistrations.some(
+        (entry) => entry.instanceItemHash === args.itemHash && entry.confirmed
+      );
+      if (confirmedAfterRefresh) {
+        this.trace("deploy:relay-metadata-recovered-from-refresh", {
+          itemHash: args.itemHash
+        });
+        return;
+      }
       throw new Error("Relay metadata did not include a peer ID and public multiaddrs.");
     }
     const { peerId } = relayMetadata;
@@ -3789,6 +3912,7 @@ var SponsorRelayController = class {
       }
     }
     if (profile === "uc-go-peer" && args.deploymentToken) {
+      let cleanupAggregateItemHash = null;
       await deleteVmBootstrapConfig({
         sender: this.state.wallet.address,
         deploymentToken: args.deploymentToken,
@@ -3797,6 +3921,14 @@ var SponsorRelayController = class {
         fetch: asJsonFetch,
         apiHost: this.client.apiHost,
         sync: true
+      }).then((cleanupResult) => {
+        cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
+        this.trace("deploy:bootstrap-config-cleanup-complete", {
+          itemHash: args.itemHash,
+          deploymentToken: args.deploymentToken,
+          aggregateItemHash: cleanupResult.aggregateItemHash,
+          aggregateStatus: cleanupResult.aggregateStatus
+        });
       }).catch((error) => {
         this.trace("deploy:bootstrap-config-cleanup-error", {
           itemHash: args.itemHash,
@@ -3804,8 +3936,75 @@ var SponsorRelayController = class {
           error: error instanceof Error ? error.message : String(error)
         });
       });
+      await this.cleanupStaleVmBootstrapConfigHistory({
+        itemHash: args.itemHash,
+        currentAggregateItemHash: cleanupAggregateItemHash,
+        stage: "publishing-bootstrap",
+        progress: 99
+      });
     }
   }
+  async cleanupStaleVmBootstrapConfigHistory(args) {
+    if (!this.state.wallet.address || !args.currentAggregateItemHash) {
+      return;
+    }
+    const staleHashes = await listStaleVmBootstrapConfigAggregateMessageHashes({
+      address: this.state.wallet.address,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      olderThanMs: VM_BOOTSTRAP_CONFIG_HISTORY_RETENTION_MS,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-scan-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        error: error instanceof Error ? error.message : String(error)
+      });
+      return [];
+    });
+    if (staleHashes.length === 0) {
+      return;
+    }
+    const staleCount = staleHashes.length;
+    this.emitProgress({
+      stage: args.stage,
+      label: "Cleaning up stale handoff history",
+      progress: args.progress,
+      status: "warning",
+      itemHash: args.itemHash,
+      detail: `Forgetting ${staleCount} superseded Aleph handoff aggregate message${staleCount === 1 ? "" : "s"} older than 6 hours. MetaMask may request another cleanup signature.`
+    });
+    this.trace("deploy:bootstrap-config-history-cleanup-start", {
+      itemHash: args.itemHash,
+      currentAggregateItemHash: args.currentAggregateItemHash,
+      staleHashes
+    });
+    await forgetAlephMessages({
+      sender: this.state.wallet.address,
+      hashes: staleHashes,
+      reason: "Prune stale vm-bootstrap-config aggregate history older than 6 hours",
+      signer: personalSign,
+      hasher: sha256Hex,
+      fetch: asJsonFetch,
+      apiHost: this.client.apiHost,
+      sync: true
+    }).then((cleanupResult) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-complete", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        forgetItemHash: cleanupResult.itemHash,
+        forgetStatus: cleanupResult.status
+      });
+    }).catch((error) => {
+      this.trace("deploy:bootstrap-config-history-cleanup-error", {
+        itemHash: args.itemHash,
+        currentAggregateItemHash: args.currentAggregateItemHash,
+        staleHashes,
+        error: error instanceof Error ? error.message : String(error)
+      });
+    });
+  }
   syncLatestDeploymentProgress(instances) {
     const itemHash = this.state.lastDeploymentHash;
     if (!itemHash) {
@@ -3881,6 +4080,20 @@ var SponsorRelayController = class {
       });
       return;
     }
+    const hasConfirmedBootstrapRegistration = this.state.bootstrapRegistrations.some(
+      (entry) => entry.instanceItemHash === itemHash && entry.confirmed
+    );
+    if (hasConfirmedBootstrapRegistration) {
+      this.emitProgress({
+        stage: "completed",
+        label: "Relay ready",
+        progress: 100,
+        status: "success",
+        itemHash,
+        detail: "Runtime networking is available and the relay bootstrap registration is confirmed on Aleph."
+      });
+      return;
+    }
     this.emitProgress({
       stage: "deployment-confirmed",
       label: "Runtime ready",
@@ -4181,7 +4394,11 @@ var SponsorRelayController = class {
           instances.map((entry) => entry.instance.item_hash)
         );
         bootstrapRegistrations = selectCurrentRelayBootstrapPosts(rawBootstrapPosts).filter(
-          (entry) => entry.address?.toLowerCase() === normalizedWalletAddress
+          (entry) => relayBootstrapMatchesCurrentWallet(
+            entry,
+            normalizedWalletAddress,
+            activeInstanceHashes
+          )
         ).map((entry) => {
           const instanceItemHash = relayBootstrapInstanceItemHash(entry);
           const messageHash = entry.itemHash ?? entry.hash ?? null;
@@ -4200,6 +4417,8 @@ var SponsorRelayController = class {
               registrationId: entry.content.registrationId,
               multiaddrs: Array.isArray(entry.content.multiaddrs) ? entry.content.multiaddrs : [],
               browserMultiaddrs: Array.isArray(entry.content.browserMultiaddrs) ? entry.content.browserMultiaddrs : [],
+              ownerAddress: typeof entry.content.ownerAddress === "string" ? entry.content.ownerAddress : void 0,
+              publisherAddress: typeof entry.content.publisherAddress === "string" ? entry.content.publisherAddress : void 0,
               updatedAt: entry.content.updatedAt
             } : null
           };
@@ -4271,9 +4490,9 @@ var SponsorRelayController = class {
       this.patch({ errorText: "Connect MetaMask before deploying." });
       return;
     }
-    if (!this.state.manifest || !this.state.rootfsVerified || !this.state.pricingSummary.pricing || !this.state.pricingSummary.tier) {
+    if (!this.state.manifest || this.state.rootfsHealth.tone !== "ok" || !this.state.pricingSummary.pricing || !this.state.pricingSummary.tier) {
       this.patch({
-        errorText: "Manifest, rootfs, and pricing must be ready before deploying."
+        errorText: this.state.rootfsHealth.tone === "error" ? `Cannot deploy: ${this.state.rootfsHealth.detail ?? this.state.rootfsHealth.label}` : "Manifest, rootfs, and pricing must be ready before deploying."
       });
       return;
     }
@@ -4315,6 +4534,7 @@ var SponsorRelayController = class {
       for (const [candidateIndex, candidateCrn] of orderedCrns.entries()) {
         let attemptItemHash = null;
         let attemptDeploymentToken = null;
+        let attemptProfile = null;
         const crnAttemptLabel = `CRN ${candidateIndex + 1}/${orderedCrns.length}`;
         const crnDisplayName = candidateCrn.name ?? candidateCrn.hash;
         this.emitProgress({
@@ -4326,6 +4546,7 @@ var SponsorRelayController = class {
         });
         try {
           const profile = relayProfileForManifest(this.state.manifest);
+          attemptProfile = profile;
           const sshPublicKey = profile === "uc-go-peer" ? appendDeploymentTokenToSshPublicKey(
             this.state.sshPublicKey.trim(),
             this.state.wallet.address,
@@ -4561,6 +4782,106 @@ var SponsorRelayController = class {
             itemHash: attemptItemHash,
             error: lastError.message
           });
+          if (attemptItemHash && attemptDeploymentToken && attemptProfile && !failedDueToInvalidIpv6) {
+            try {
+              const latestRuntime = await fetchVmRuntime({
+                itemHash: attemptItemHash,
+                fetch: (url, init) => fetch(url, init),
+                crnHash: candidateCrn.hash,
+                crns: this.state.crns,
+                crnListUrl: this.props.crnListUrl,
+                requirePublicGuestIpv6ForProxy: true
+              });
+              if (latestRuntime.diagnostics?.state === "ready") {
+                const reconciledRelayMetadata = await fetchRelayMetadataForRuntime({
+                  runtime: latestRuntime,
+                  fetch: (url, init) => fetch(url, init),
+                  preferSecureMetadata: attemptProfile === "uc-go-peer" && Boolean(latestRuntime.proxyUrl),
+                  attempts: 3,
+                  delayMs: 1e3,
+                  timeoutMs: 15e3
+                }).catch(() => null);
+                if (reconciledRelayMetadata) {
+                  const registrationId = createRelayBootstrapRegistrationId(
+                    attemptProfile,
+                    this.state.instanceName.trim(),
+                    attemptItemHash
+                  );
+                  const visibleRegistration = await waitForRelayBootstrapRegistration({
+                    registrationId,
+                    peerId: reconciledRelayMetadata.peerId,
+                    fetch: asJsonFetch,
+                    apiHost: this.client.apiHost,
+                    attempts: 3,
+                    delayMs: 1e3
+                  }).catch(() => null);
+                  if (visibleRegistration) {
+                    this.trace("deploy:recovered-after-error", {
+                      itemHash: attemptItemHash,
+                      registrationId,
+                      peerId: reconciledRelayMetadata.peerId,
+                      error: lastError.message
+                    });
+                    this.rememberRuntimeDetails(attemptItemHash, {
+                      messageStatus: "processed",
+                      allocationSource: latestRuntime.allocation?.source ?? null,
+                      crnUrl: latestRuntime.allocation?.crnUrl ?? latestRuntime.execution?.crnUrl ?? null,
+                      hostIpv4: latestRuntime.hostIpv4 ?? null,
+                      ipv6: latestRuntime.ipv6 ?? null,
+                      vmIpv4: latestRuntime.execution?.networking?.ipv4_ip ?? null,
+                      webUrl: latestRuntime.webAccessUrl ?? latestRuntime.proxyUrl ?? latestRuntime.execution?.networking?.proxy_url ?? null,
+                      sshCommand: latestRuntime.sshCommand ?? null,
+                      mappedPorts: latestRuntime.execution != null ? mappedPorts(latestRuntime.execution) : runtimeMappedPorts(latestRuntime.mappedPorts),
+                      execution: latestRuntime.execution ?? null,
+                      error: null
+                    });
+                    this.patch({
+                      busy: { deploying: false }
+                    });
+                    await this.refresh();
+                    this.lastCompletedDeploymentHash = attemptItemHash;
+                    this.emitProgress({
+                      stage: "completed",
+                      label: "Relay ready",
+                      progress: 100,
+                      status: "success",
+                      itemHash: attemptItemHash,
+                      detail: "The relay completed startup after a transient UI polling error. Runtime and bootstrap registration are confirmed."
+                    });
+                    return;
+                  }
+                }
+              }
+            } catch (reconcileError) {
+              this.trace("deploy:recovery-check-error", {
+                itemHash: attemptItemHash,
+                error: reconcileError instanceof Error ? reconcileError.message : String(reconcileError)
+              });
+            }
+            await this.refresh().catch(() => void 0);
+            const recoveredRegistration = this.state.bootstrapRegistrations.some(
+              (entry) => entry.instanceItemHash === attemptItemHash && entry.confirmed
+            );
+            if (recoveredRegistration) {
+              this.trace("deploy:recovered-from-refresh-state", {
+                itemHash: attemptItemHash,
+                error: lastError.message
+              });
+              this.patch({
+                busy: { deploying: false }
+              });
+              this.lastCompletedDeploymentHash = attemptItemHash;
+              this.emitProgress({
+                stage: "completed",
+                label: "Relay ready",
+                progress: 100,
+                status: "success",
+                itemHash: attemptItemHash,
+                detail: "The relay completed startup after a transient browser-side polling error. Runtime and bootstrap registration are confirmed."
+              });
+              return;
+            }
+          }
           if (attemptItemHash) {
             this.emitProgress({
               stage: "deployment-confirmed",
@@ -4571,6 +4892,7 @@ var SponsorRelayController = class {
               detail: failedDueToInvalidIpv6 ? `${attemptLabel} exposed runtime networking that cannot support proxy-backed HTTPS. Cleaning up this attempt before retrying another CRN.` : `${attemptLabel} failed: ${lastError.message} Cleaning up this attempt before retrying another CRN.`
             });
             if (attemptDeploymentToken) {
+              let cleanupAggregateItemHash = null;
               this.emitProgress({
                 stage: "deployment-confirmed",
                 label: "Cleaning up failed attempt",
@@ -4592,6 +4914,7 @@ var SponsorRelayController = class {
                 apiHost: this.client.apiHost,
                 sync: true
               }).then((cleanupResult) => {
+                cleanupAggregateItemHash = cleanupResult.aggregateItemHash;
                 this.trace("deploy:bootstrap-config-cleanup-complete", {
                   itemHash: attemptItemHash,
                   deploymentToken: attemptDeploymentToken,
@@ -4605,6 +4928,12 @@ var SponsorRelayController = class {
                   error: cleanupError instanceof Error ? cleanupError.message : String(cleanupError)
                 });
               });
+              await this.cleanupStaleVmBootstrapConfigHistory({
+                itemHash: attemptItemHash,
+                currentAggregateItemHash: cleanupAggregateItemHash,
+                stage: "deployment-confirmed",
+                progress: 18
+              });
             }
             this.emitProgress({
               stage: "deployment-confirmed",

package/svelte/SponsorRelayFab.svelte

@@ -193,7 +193,7 @@ export let apiHost = undefined
 
     <div class="actions">
       {#if state.wallet.connected}
-        <button class="primary" type="button" on:click={() => controller.deploy()} disabled={state.busy.deploying || !state.rootfsVerified}>
+        <button class="primary" type="button" on:click={() => controller.deploy()} disabled={state.busy.deploying || state.rootfsHealth.tone !== 'ok'}>
           {state.busy.deploying ? 'Deploying…' : 'Deploy Relay'}
         </button>
       {:else}